Search: 7.3.1.1

CVE-2026-111031 is an open redirect vulnerability in the Welcart e-Commerce WordPress plugin versions before 2.12.6. The plugin fails to validate user-supplied URLs before redirecting, allowing unauthenticated attackers to redirect users to arbitrary external sites. This vulnerability has a medium severity with a CVSS score of 4.7. It was fixed in version 2.12.6.

CVE-2026-111021 is a reflected Cross-Site Scripting (XSS) vulnerability in the Persian WooCommerce SMS WordPress plugin versions 7.2.0 up to but not including 7.3.2. The flaw arises because the plugin fails to properly sanitize and escape a parameter before reflecting it into an HTML attribute. This allows an attacker to execute malicious scripts in the browser session of a logged-in privileged user who is tricked into submitting a crafted request. The vulnerability has a high severity score of 7.1 and was fixed in version 7.3.2.

CVE-2026-107100 is a vulnerability in the Royal Addons for Elementor WordPress plugin versions 1.3.81 up to but not including 1.7.1070. It allows unauthenticated users to access content of posts stored in non-public post types via an AJAX action that does not properly verify post visibility. This can lead to exposure of sensitive information such as contact form submissions containing names, email addresses, and messages.

CVE-2026-107098 is a cross-site scripting (XSS) vulnerability in the Royal Addons for Elementor WordPress plugin versions from 1.7.1037 up to but not including 1.7.1070. The flaw arises because the plugin does not properly sanitize and escape a map widget's size setting before inserting it into an HTML attribute. This allows users with Contributor role or higher to inject JavaScript that executes in the browsers of users viewing the affected page, including administrators reviewing submissions. The vulnerability is fixed in version 1.7.1070.

A missing authorization vulnerability in Royal Addons for Elementor WordPress plugin versions 1.3.71 up to but not including 1.7.1070 allows unauthenticated attackers to add arbitrary subscriber records to the site owner's Mailchimp audience using stored credentials. This flaw permits injection of email addresses and contact details without any authorization checks.

CVE-2026-106647 is a missing authorization vulnerability in the Royal Addons for Elementor WordPress plugin versions 1.3.68 up to but not including 1.7.1070. The plugin improperly scopes contact form email delivery configurations in a site-global namespace keyed by a non-secret identifier exposed publicly. This allows users with Author role or higher to overwrite other users' form configurations, potentially redirecting form submissions to attacker-controlled email addresses. The issue is fixed in version 1.7.1070.

CVE-2026-105997 is a vulnerability in the Booking Package WordPress plugin before version 1.7.33. It allows unauthenticated users to trigger booking verification-code emails to arbitrary recipients because the plugin does not restrict who can initiate these emails nor bind the recipient to server-side state. This can lead to denial of service impacts due to email flooding but does not affect confidentiality or integrity.

CVE-2026-105972 is a Cross-Site Scripting (XSS) vulnerability in the Menu Cart for WooCommerce WordPress plugin versions before 3.2.1. The flaw arises because the plugin does not properly sanitize and escape cart item variation data before displaying it in the cart slide-out. This allows unauthenticated attackers to inject malicious scripts that execute in the context of other users' sessions, including administrators. The vulnerability has a high severity with a CVSS score of 7.5 and was fixed in version 3.2.1.

A remote code execution vulnerability exists in Ultralytics due to unsafe deserialization in the torch_load function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118613 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics' check_det_dataset component, allowing attackers to execute arbitrary code if a user interacts with malicious content. The vulnerability requires user interaction such as visiting a malicious page or opening a malicious file. It has been assigned CVE-2026-118614 and a CVSS rating of 7.8 by the Zero Day Initiative.

CVE-2026-115522 is a vulnerability in Google Agent Development Kit (ADK) for Python that allows an application to access or modify artifacts belonging to another application when both share a FileArtifactService root directory and the same user_id. This occurs because the service omitted the application name when constructing on-disk paths, leading to improper resource isolation. The issue affects versions 1.19.0 through before 1.39.1 and 2.0.0a1 through before 2.7.0. The vulnerability was fixed by enforcing full per-application path scoping in versions 1.39.1 and 2.7.0.

CVE-2026-104384 is a high-severity vulnerability in EagleCloud Aquila on on-premises platforms up to version 2.6.7.2. It involves insufficient protection of credentials in the tunnel gateway and provisioning interfaces, allowing unauthenticated remote attackers to escalate privileges and access sensitive keys and secrets.

CVE-2026-104383 is a critical code injection vulnerability in the Pigeon MFA service of EagleCloud Aquila on-premises versions up to 2.6.7.2. Authenticated remote attackers can exploit improper control of code generation to execute arbitrary code on affected systems.

Tabularis versions before 0.28.0 have an SQL injection vulnerability in the SQLite driver. This flaw allows MCP clients to execute stacked SQL statements by manipulating the table_name parameter in the describe_table tool. Exploitation can bypass read-only mode and write approval, enabling attackers to read, modify, or delete SQLite data. The vulnerability carries a high severity rating with a CVSS score of 7.8.

rtl_433 versions through 25.12 have a stack-based buffer overflow vulnerability in the proflame2_mc() function. This flaw allows an attacker within radio range to send more than seven valid Manchester-coded words, overflowing a 7-byte stack buffer. Exploitation can cause rtl_433 to crash and potentially corrupt stack memory, enabling control-flow hijacking on builds lacking stack canaries.